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TAGS:  EINT  POLICY  TINT  SECURITY  PREL  PUBLIC  RELATIONS 
SUBJECT:  PRESIDENT'S  ROLLOUT  OF  THE  60-DAY  CYBERSPACE 
POLICY  REVIEW 

IQ.  (U)  Posts  are  encouraged  to  use  the  press  guidance 
and  other  information  contained  in  Paragraph  3 below  on 
the  President's  60-day  Cyberspace  Policy  Review  to  brief 
host  governments  and  other.  The  U.S.  Government 
anticipates  working  with  foreign  governments  in 
bilateral  and  multilateral  settings  to  advance  our 
common  interests  in  cybersecurity . Please  report  any 
interest  on  cybersecurity  engagement  and/or  reaction  to 
the  rollout  of  the  60-day  Cyberspace  Policy  Review  by 
front  channel  cable,  slugging  your  response  for 
INR/CYBER.  INR/CYBER  coordinates  within  the  Department 
through  the  Department's  Cyber  Policy  Group  (CPG) . 

T_2 . (U)  Background.  The  President  has  identified 
cybersecurity  as  one  of  the  top  priorities  of  his 
administration  and  directed  an  early  60-day, 
comprehensive  review  to  assess  U.S.  policies  and 
structures  for  cybersecurity . The  review  addressed  all 
missions  and  activities  associated  with  the  information 
and  communications  infrastructure  and  the  strategy  will 
put  a strong  emphasis  on  collaboration  with 
international  partners  across  a range  of  issues. 

(U)  The  President  hosted  an  event  on  Friday,  May  29th  at 
the  White  House  announcing  the  conclusion  of  the  60-Day 
Cyber  Policy  Review  and  endorsing  the  Review  team's 
report.  In  addition  to  several  Cabinet  secretaries, 
representatives  from  the  private  sector,  the  Ambassadors 
from  the  UK,  Canada,  Australia  and  New  Zealand;  and 
representatives  of  the  EU  and  the  OAS  were  in 
attendance . 

(U)  The  report  includes  a near-term  action  plan  which 
recommends  the  appointment  of  a "cyber  security  policy 
official"  based  in  the  White  House  and  responsible  for 
coordinating  the  nation's  cybersecurity  policies  and 
activities.  A non-operational  directorate,  dual-hatted 
to  the  National  Security  and  National  Economic  Councils, 
will  be  established  under  this  official.  Interagency 
coordination  will  occur  primarily  through  the 
Information  and  Communications  Infrastructure 
Interagency  Policy  Committee  (ICI-IPC)  and  five  sub- 
IPCs,  including  an  International  Sub-IPC.  The  Sub-IPCs 
will  begin  meeting  immediately. 

1[3 . (U)  Press  Guidance.  There  will  be  a public  web  page 
for  cybersecurity  at 

http : / /www . whitehouse . gov/cyberreview 
which  will  include  links  to  the  60-day  report, 
submissions  to  the  60-day  review  by  outside  groups, 
streaming  video  from  the  President's  speech,  and  videos 
from  the  Secretary  of  DHS  among  others  discussing 


cybersecurity  issues. 


(U)The  White  House  issued  the  following  Q&As  drafted  by 
the  National  Security  Council  and  approved  for  the 
Press : 

- What  is  meant  when  you  use  the  term  "Cyber security " ? 

- ANSWER:  As  used  in  the  Report  the  term 

"Cyber security"  encompasses  far  more  than  simply  taking 
preventative  actions  like  patching  computer  systems. 
Cybersecurity  broadly  includes  strategy,  policy,  and 
standards  regarding  the  security  of  and  operations  in 
cyberspace,  and  encompasses  the  full  range  of  threat 
reduction,  vulnerability  reduction,  deterrence, 
international  engagement,  incident  response,  resiliency, 
and  recovery  policies  and  activities,  including  computer 
network  operations,  information  assurance,  law 
enforcement,  diplomacy,  military  and  intelligence 
missions  as  they  relate  to  the  security  and  stability  of 
the  global  information  and  communications 
infrastructure . 

- What  are  the  next  steps /priorities  going  forward? 

--  ANSWER:  The  Report  outlines  an  ambitious  short-  and 

mid-term  action  plan  of  vital  tasks  that  must  be 
addressed  to  help  secure  our  information  and 
communications  infrastructure.  This  work  will  require 
both  the  coordinated  effort  of  many  federal  departments 
and  agencies  and  unprecedented  partnership  with  the 
private  sector,  academia,  state  and  local  authorities, 
our  international  counterparts,  and  the  public.  Some  of 
the  key  short-term  tasks  are:  preparing  an  updated 
national  strategy  to  secure  the  information  and 
communication  infrastructure;  initiating  a dialogue  to 
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enhance  public-private  partnership,  and  initiating  a 
national  public  awareness  and  education  campaign  to 
promote  cybersecurity.  We  have  much  to  do  and  it  is  a 
long  road  ahead,  but  we  are  on  the  right  path  and  moving 
forward  in  an  organized  and  comprehensive  way. 

- How  are  the  actions  outlined  in  the  report  different 
than  the  efforts  in  the  last  administration? 

--  ANSWER:  We  are  addressing  the  broad  span  of 

cybersecurity  in  a truly  comprehensive  way  and 
designating  it  as  a national  priority  so  that  we  can 
achieve  sustained  long  term  success.  No  longer  are  we 
treating  cybersecurity  as  a destination  in  itself,  but 
instead  understand  that  it  is  a compass  that  will  guide 
our  country  to  future  economic  growth  and  prosperity  by 
providing  a stable  and  secure  foundation  for  commerce 
and  communications.  Though  we  are  building  on  the 
progress  made  during  the  last  administration,  the  scope 
and  inclusiveness  of  our  approach  is  far  broader.  Among 
other  things,  the  President  has  designated  a White  House 
Cybersecurity  Policy  Official,  who  will  be  the  center  of 
gravity  for  cybersecurity  issues.  We  are  also  committed 
to  addressing  other  issues  where  progress  is  needed, 
including  building  a collaborative  and  workable  public- 
private  partnership,  creating  an  effective  cyber 
incident  response  plan,  ensuring  that  foundational 
issues  of  infrastructure  architecture  incorporate 
security  at  the  design  stage,  and  substantially 
strengthening  our  strategic  engagement  with  our  foreign 
partners . 

- What  does  this  report  mean  for  our  international 
partners? 

--  ANSWER:  Cyberspace  crosses  international  boundaries, 
and  if  we  are  to  succeed  in  securing  it  we  cannot  act  in 
isolation.  The  global  challenge  of  securing  cyberspace 
requires  an  increased  effort  to  work  with  all  countries- 
including  those  in  the  developing  world  who  face  these 
issues  as  they  build  their  digital  economies  and 
inf rastructures-plus  international  bodies,  military 


allies,  and  intelligence  partners.  This  effort  will 
seek-in  continued  collaboration  with  the  private  sector- 
to  improve  the  security  of  interoperable  networks 
through  the  development  of  global  standards,  expand  the 
legal  system's  capacity  to  combat  cyber  crime,  continue 
to  develop  and  promote  best  practices,  and  maintain 
stable  and  effective  Internet  governance.  The  United 
States  needs  to  develop  a strategy  designed  to  shape  the 
international  environment  and  bring  like-minded  nations 
together  on  a host  of  issues,  including  acceptable 
international  norms  that  are  critical  to  establishing  a 
secure  and  thriving  digital  infrastructure. 

Accordingly,  one  of  the  priority  short  term  actions 
identified  in  the  Report  is  developing  "U.S.  Government 
positions  for  an  international  cybersecurity  policy 
framework  and  strengthen  our  international  partnerships 
to  create  initiatives  that  address  the  full  range  of 
activities,  policies,  and  opportunities  associated  with 
cybersecurity . " 

- Australia,  the  U.K.,  Canada,  France,  New  Zealand,  and 
China  all  are  working  on  or  have  announced  cybersecurity 
strategies.  Has  the  United  States  lost  the  chance  to 
lead  in  this  important  area? 

--  ANSWER:  The  fact  that  many  countries  around  the 

world  are  recognizing  the  importance  of  cybersecurity  is 
a positive  step  since  this  issue  transcends  national 
boundaries  and  requires  unprecedented  international 
cooperation.  We  have  worked  with  many  countries  both  in 
raising  their  awareness  of  this  issue  and  exchanging 
information  about  how  best  to  address  it  at  a national 
and  international  level.  The  heightened  importance  that 
the  President  is  giving  to  cybersecurity,  including 
detailing  an  aggressive  action  plan  that  encompasses 
renewed  international  engagement,  helps  us  and  our 
closest  allies  continue  to  lead  in  this  vital  area. 

- What  is  the  scope  of  responsibility  of  the 
Cybersecurity  Policy  Official? 

--  ANSWER:  The  Cybersecurity  Policy  Official  - in 

consultation  with  the  Federal  government ' s Chief 
Technology  Officer  and  Chief  Information  Officer  and 
other  offices  including  the  office  of  Management  and 
Budget,  the  Office  of  Science  and  Technology  Policy  and 
the  National  Economic  Council  - will  harmonize 
cybersecurity-related  policy  and  technology  efforts 
across  the  Federal  government,  ensure  that  the 
President's  budget  reflects  federal  priorities  for 
cybersecurity,  and  develop  a legislative  agenda  for 
cybersecurity . 

- What  are  the  roles  and  responsibilities  of  the 
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Cybersecurity  Policy  Official? 

— ANSWER:  The  Cybersecurity  Policy  Official  will 

coordinate  interagency  development  of  policies  and 
strategies  for  the  security  of  and  operations  in 
cyberspace  that  will  help  the  United  States  achieve  a 
more  secure,  reliable,  resilient,  and  trustworthy 
digital  infrastructure  for  the  future.  The 
Cybersecurity  Policy  Official  will  focus  on  harnessing 
the  full  benefits  of  innovation  to  address  cybersecurity 
concerns  and  work  on  policies  that  address  national 
security  requirements,  protection  of  intellectual 
property,  and  assuring  the  availability  and  continuity 
of  infrastructure. 

- If  the  United  States  suffers  a major  cyber  attack 
tomorrow,  who  is  in  charge  and  how  will  we  respond? 

--  ANSWER:  Ultimately,  the  White  House  is  responsible 

for,  and  in  charge  of,  high-level  coordination  during 
any  major  incident  - including  a major  cyber  incident. 
Many  departments  and  agencies  have  important  operational 
roles  with  respect  to  incident  response,  including  the 
Departments  of  Homeland  Security,  Justice,  and  Defense 


and  the  Intelligence  Community,  and  each  would  continue 
to  perform  its  operational  roles  in  line  with  overall 
White  House  strategic  direction. 

- There  are  a lot  of  reports  about  other  countries  (e.g. 
Russia  and  China)  attacking  U.S.  networks.  Isn't  the 
U.S.  engaging  in  the  same  activity?  What  are  we  doing 
about  these  intrusions? 

--  ANSWER:  The  cybersecurity  threat  is  real  and  growing. 
Both  foreign  governments  and  criminals  seek  to  exploit 
security  holes  in  our  government  and  private-sector 
networks  to  steal  money  and  information  and  potentially 
to  disrupt  the  networks  themselves.  Individual 
departments  and  agencies  play  various  roles  in  securing 
government  networks  and  investigating  and  prosecuting 
cyber  crime.  The  cyberspace  policy  review  surveyed  U.S. 
government  cybersecurity  activities  and  developed  action 
plans  to  build  additional  capabilities  and  to  make 
government  cybersecurity  efforts  more  effective. 

Minimize  Considered. 

CLINTON 


